Passkey

A passkey is a key pair created by a person's device, such as a phone, laptop or security key, for one specific website. The private half stays on the device, unlocked by a fingerprint, face or PIN. The site keeps only the public half. Passkeys are built on the WebAuthn and FIDO2 standards.

Why they're better than passwords and one-time codes:

• Phishing-resistant: a passkey is bound to the real site's domain, so a look-alike site can't use it.
• Nothing to steal from the server: the site holds only public keys.
• Every use is a signature, which can cover exactly what's being approved.

On Valtu

Team members confirm payout approvals with passkeys on their own devices. The approval is a signature over the exact amount and destination, so it can't be reused for a different payout. With team signing turned on, the enclave verifies those passkey signatures itself before signing, so a compromised server can't forge an approval. See approval policy.